CVE-2025-40362

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix multifs mds auth caps issue

The mds auth caps check should also validate the

fsname along with the associated caps. Not doing

so would result in applying the mds auth caps of

one fs on to the other fs in a multifs ceph cluster.

The bug causes multiple issues w.r.t user

authentication, following is one such example.

Steps to Reproduce (on vstart cluster):

1. Create two file systems in a cluster, say 'fsname1' and 'fsname2'

2. Authorize read only permission to the user 'client.usr' on fs 'fsname1'

$ceph fs authorize fsname1 client.usr / r

3. Authorize read and write permission to the same user 'client.usr' on fs 'fsname2'

$ceph fs authorize fsname2 client.usr / rw

4. Update the keyring

$ceph auth get client.usr >> ./keyring

With above permssions for the user 'client.usr', following is the

expectation.

a. The 'client.usr' should be able to only read the contents

and not allowed to create o

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References